Classmates Reunion’ Used As Malware Ploy

[Peaches]

Jan1 2009

‘Classmates Reunion’ Used as Malware Ploy

by Florabel Baetiong (Anti-spam Research Engineer)

"Class reunion invitations (supposedly from classmates.com) are being seen in spam recently — recipients of these messages are asked to click on a link found in the message to get the details of the “reunion†and also see a related video.

Looking at the IP origins of sample spam messages, it appears that these have been sent out by spam bots using dynamic IPs from different dialup and broadband ISPs.

Clicking on the link would actually direct users to a malicious webpage. In this page, a message prompts users to update their Adobe player to be able to view the reunion video, thus tricking them into executing a malicious file.

Trend Micro detects the file as TROJ_AGENT.ADB.

Details & screenshots here: http://blog.trendmicro.com/